Chapter 11: Security Operations - Security Operations and Administrative Management

A core principle when it comes to administrative management is the concept of separation of duties. This term means that roles are specified to only do one distinct thing. This idea ensures that one person alone could not compromise the whole company by either making a mistake or with intentions of causing harm. Common roles with their descriptions are listed below:

Control Group - Gets the information from different groups or people and passes the information along to the groups or people that need the information to do their jobs.

Systems Analyst - Designs how data will be used in a system or how the data will be transferred from system to system based upon requirements provided by the user as long as those requirements are within the scope of operation.

Application Programmer - Develop software and maintains software.

Help Desk/Support - Responsible for fixing technical issues within the organization and provides guidance to clients and employees for using systems.

IT Engineer - Responsible for doing routine operations on systems on a daily basis to keep them up and running. 

Database Administrator - Develops new data models for database implementations and maintain the databases in an organization.

Network Administrator - Installs Local Area Networks and/or Wide Area Networks for use within the company. Also responsible for maintaining these networks.

Security Administrator - Responsible for the security framework. They develop the security controls, implement them, and insure that these controls are in use effectively.

Tape Librarian - Responsible for backing up and keeping record of all important data.

Quality Assurance - Ensures that activities meet the standards of requirements. Responsible for testing the activities to find issues and pass the issues back to the appropriate group so that the problem/issue can be resolved. 

Chapter 10: Software Development Security - Malware

Malware, also known as malicious software, comes in many forms. Some examples are viruses, worms, Trojan horses, and logic bombs. Malware can be spread through a variety of methods, including email and downloads from the internet. First off, I want to identify what a virus is and the different types of viruses. A virus is an application that infects software. They cannot reproduce on their own, and must have a host program. After attaching to a host application, it then gives its payload to the host. The payload could be a few different things such as deleting files, displaying useless information, or thieving data from the application or system that it has infected. A macro virus is a form of a virus that infects macro programs; programs that are written in Word Basic, Visual Basic, or VBscript. They generally infect Microsoft Office. They are pretty easy to write and affect the templates of documents. A boot-sector virus is one that, as the name implies, affects the boot sector of a computer. They either reposition data or override data within the boot sector. A third type of virus, the compression virus, finds an uninfected executable file and attaches itself to it. It them compresses the executable using system permissions. When the user runs that executable, the virus proceeds to run. A stealth virus is one that essentially makes it look like the system is the same as it was before infection. Another common type of malware is a worm. A worm is a program that replicates itself in order to spread to other machines. It usually spreads through networks that have security flaws. While a virus has to have a host program, worms do not. They can be standalone programs. A Trojan horse is a program that disguises itself to look like an existing program. For example, the Trojan horse can look exactly like an everyday application. When a user runs makes the unknowing mistake of opening the Trojan horse (because it looks just like the app they use daily) the regular app is opened but the Trojan horse is executing its malicious actions in the background. Unlike viruses, they do not replicate themselves but can be just as devastating as viruses. A logic bomb slightly differs from the the previous types of malware discussed. It is a sting of code that is executed when certain conditions are met. For example, it could be coded in such a way that when a user visits a certain website, it triggers the logic bomb and, for example, deletes certain specified files from the system.

Chapter 10: Software Development Security - Expert Systems/Knowledge-Based Systems and Artificial Neural Networks

Expert Systems - Another name for knowledge based systems. These types of systems use artificial intelligence in order to solve extremely complex problems. To put in terms that non-computer people would understand, they attempt to mirror the thought process of a human expert in the field of the particular problem.

Inference Engine - This is the center of the knowledge base system. It is a program that tries to come up with answers from the kbase for a problem. The main purpose here is to come up with legitimate conclusions based upon the retrieved data in the kbase.

Rule-based programming - A method of programming knowledge-based systems. Uses if-then logic with particular actions that must take place for individual situations.

Artificial Neural Networks - Programs or models in computing that attempt to mimic a human brain. These programs can even learn as they go, but connot deal with "fuzzy logic" well. The study guide puts it this way: ANNs cannot see the gray in the world, such as good and bad.

Chapter 10: Software Development Security - Database Management Part 2

There are four languages when dealing with relational databases.

Data definition language - Defines the database schema or structure.

Data manipulation language - defines the data and how the data can be manipulated when retrieved.

Data control language - grans access to people or systems that cab carry out certain functions within the database.

Query Language - the language commands are written in in order to retrieve data, insert data, update data, or delete data from a database.

A data dictionary is where data about the data is stored. This info is often referred to as metadata. Another concept that is important to remember about relational databases is the concept of primary and foreign keys. A primary key is a unique value that no other record can posses. When you relate two tables, the primary key attribute of one table becomes the foreign key of another. This is what relates the two tables.

Chapter 10: Software Development Security - Database Management

Types of database models:

Relational- Uses columns and rows to organize data into tables. The columns are the attributes that each record has while the row is the collection of each records individual attributes. Most widely used model of today. Uses primary keys and foreign keys to develop relationships.

Hierarchical- Uses a tree structure with parent/child relationships. Parents can have one child, many children, or no children. Not as flexible as relational databases.

Network- Similar to the hierarchical model. However, in this model, each data element can have multiple parent child records. This model is a little bit more flexible than the hierarchical model because it allows redundancy.

Object-Oriented- Can handle a variety of data types such as images, documents, and video. Really dynamic because objects are created when needed and sent with the object is the needed functionality of the object.

Object-Relational- This type is relational database with a front end designed from an object oriented programming language. Useful to have the methods already there to actually do something with the retrieved data.

Chapter 10: Software Development Security - Web Security

Threats on the web:

Information gathering- This is step one during a hacker's attempt to cause damage to your system. Usually goes unnoticed on the web server side because they can simply use search engines to find the information that they want.

Administrative interfaces- Not a very good idea to use a web-based administrative interface. Use superior authentication method rather than the simple username/password method. Also, have strong control over which systems can access the administrative system.

Authentication and access control- To protect against this threat, use multifactor authentication. Another way to protect against this threat is to encrypt info and transfer the data using a secure protocol.

Input validation- path or directory traversal: dot-dot-slash method. Attackers try to get into a web server's drive. Unicode encoding: same idea as the previous method but they use Unicode representations of characters. URL encoding: attackers bypass filters and make requests using different representations of characters. The most most famous method here is SQL injection, where an attacker puts in actual database commands to try and retrieve data from the web server.

Parameter validation- Important to validate all data that passes through the system. Client side should check for validation and then the server side should as well.

Session management- Common way to combat against this threat is to use unique session ids for every session. Do not use sequential ids as it would make it easier for the attacker to guess it.

Chapter 10: Software Development Security - Mobile Code

Mobile code is code that can be send to another location across a network and then be executed and used on the other side. In Java, Java applets are used to accomplish this. The programmer creates the applet, runs the program through a compiler and is turned into bytecode (this code is not platform specific; it can run on many platforms. This bytecode is then placed on a server available for users to download it. Once a user downloads it, the universal bytecode is then transformed into machine-level code that is specific to the type of system it was downloaded to. To accomplish this code conversion, a Java Virtual Machine is used. Usually this virtual machine is running within the users web browser. The applet is then able to be ran when it is called upson, but it is ran in what is known as a sandbox. A sandbox is an area in where potentially unsafe code from another area can be ran in a secure manner.